# CVE-2024-23657: Nuxt Devtools path traversal and authentication bypass

Source: https://junglewise.ai/threats/cve-2024-23657-nuxt-devtools-path-traversal-and-authentication-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-08-05. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-23657 · Severity: low · CVSS 3.1 · Published 2024-08-05

Nuxt Devtools is a browser extension and local development server that enables interactive debugging and development features for Nuxt applications. By default, all new Nuxt projects enable Devtools, which can be exploited by visiting a malicious webpage to read arbitrary files from a developer's computer through path traversal attacks. In certain configurations, attackers can further extract authentication tokens and achieve remote code execution by injecting malicious code into the application.

Technologies: [@nuxt/devtools (npm)](https://junglewise.ai/threats/technologies/nuxt-devtools), [Nuxt DevTools](https://junglewise.ai/threats/technologies/devtools). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [Nuxt](https://junglewise.ai/threats/vendors/nuxt).

## Quick answers

**Is CVE-2024-23657 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-23657 being exploited in the wild.

**How severe is CVE-2024-23657?** Low severity, with a CVSS score of 3.1, published 5 August 2024.

**Which products and versions are affected?** @nuxt/devtools (npm) SEMVER:introduced=0,fixed=1.3.9; Nuxt DevTools < 1.3.9.

**Is there a fix for CVE-2024-23657?** Yes. @nuxt/devtools (npm): upgrade to 1.3.9 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-23657 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-23657?** Check whether you run @nuxt/devtools (npm) or Nuxt DevTools at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @nuxt/devtools (npm): upgrade to 1.3.9 or later

  ```sh
  npm install @nuxt/devtools@1.3.9
  ```


## Technical details

The vulnerability combines three weaknesses: (1) the getTextAssetContent RPC function lacks authentication and does not sanitize path traversal sequences (../ patterns), allowing attackers to read arbitrary files; (2) the WebSocket server accepts requests without origin validation, enabling cross-site WebSocket hijacking (CSWSH); (3) Devtools authentication tokens are stored in the user's home directory in a predictable location. An attacker can craft a malicious webpage that connects to a locally running Devtools instance, brute-force the token location via path traversal, then use authenticated RPC functions like writeStaticAssets to write executable code (Components, Handlers, or app.vue) that auto-executes. This requires the user to visit a malicious site while Devtools is running and to have previously authenticated with Devtools. Patches are available in version 1.3.9 and later.

## Affected products

- Nuxt Devtools < 1.3.9

## Identifiers

- CVE-2024-23657
- GHSA-rcvg-rgf7-pppv

## Timeline

- 2024-08-05: disclosed
- 2024-08-05: patched: Version 1.3.9 and later contain fixes

## References

- [https://github.com/nuxt/nuxt/security/advisories/GHSA-rcvg-rgf7-pppv](https://github.com/nuxt/nuxt/security/advisories/GHSA-rcvg-rgf7-pppv)

## Related threats

- [Nuxt DevTools command injection via unauthenticated RPC channel](https://junglewise.ai/threats/cve-2026-71319-nuxt-devtools-command-injection-via-unauthenticated-rpc-channel)
- [Nuxt DevTools cross-site scripting in auth component](https://junglewise.ai/threats/cve-2025-52662-nuxt-devtools-cross-site-scripting-in-auth-component)